CLAIMS 



What is claimed is: 

5 1. A method for fault diagnosis of a data network 

comprising: 

a) receiving a plurality of fault data pertaining to 
said data network; 

b) filtering said plurality of fault data to obtain a 
.10 core of fault data; and 

I c) analyzing said core of fault data to identify a 

fault associated with said core of fault data. 



iyl 2. The method for fault diagnosis as described in Claim 

|=& 15 1, wherein b) comprises: 

implementing a set of rules for filtering said plurality 
fi of fault data. 

3. The method for fault diagnosis as described in 
20 Claim 1, wherein b) comprises: 

eliminating redundant fault data in said plurality of 
fault data to obtain said core of fault data. 

4. The method for fault diagnosis as described in 
25 Claim 1, wherein said b) comprises: 
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bl) correlating said plurality of fault data into 
recognized patterns of data comprising said core of fault 
data . 

5. The method for fault diagnosis as described in 
Claim 1, wherein said plurality of fault data is taken from 
group consisting of: 

alarms; 
events; 

remote monitoring (RMON)-l data; and 
RMON-2 data. 

6. The method for fault diagnosis as described in 
Claim 1, wherein c) further comprises: 

determining whether said fault is due to a broken link 
or congestion in said data network. 

7 . The method for fault diagnosis as described in 
Claim 6, further comprising: 

implementing a ping walk through said data network to 
determine a location of said broken link, if said fault is 
due to said broken link. 

8 . The method for fault diagnosis as described in 
Claim 6, further comprising: 

isolating a source of said fault, if said fault is due 
to said congestion in said data network. 
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9. The method of fault diagnosis as described in Claim 
1, further comprising: 

displaying network location of said fault; and 
displaying a cause of said fault. 

10. The method of fault diagnosis as described in 
Claim 1, wherein said fault data includes performance data 
from said data network. 

11. A method of fault diagnosis comprising: 

a) receiving a plurality of fault data pertaining to 
said data network; 

b) filtering said plurality of fault data to eliminate 
extraneous data down to a core of fault data; and 

c) determining whether said core of fault data is due 
to a broken link or congestion in said data network; 

d) performing a ping walk to isolate a cause and a 
source of said core of fault data and to determine a location 
of said source, if said core of fault data is due to said 
broken link; and 

e) using deductive reasoning to isolate said source of 
said core of fault data and identify said cause of said core 
of fault data, if said core of fault data is due to said 
congestion . 
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12. The method for fault diagnosis as described in 
Claim 11, wherein b) comprises: 

eliminating redundant fault data in said plurality of 
fault data to obtain said core of fault data. 

13. The method for fault diagnosis as described in 
Claim 11, wherein b) comprises: 

bl) correlating said plurality of fault data into a 
recognized pattern of data forming said core of fault data. 

14. The method for fault diagnosis as described in 
Claim 11, wherein d) comprises: 

sending a ping signal to each of a plurality of 

addresses in said data network; 

determining which addresses are unreachable; and 
comparing a network topology to unreachable addresses to 

determine a location of said broken link in said data 

network. 

15. The method for fault diagnosis as described in 
Claim 11, wherein e) comprises: 

el) monitoring said data network to determine traffic 
data; and 

e2) analyzing said traffic data using said deductive 
reasoning to isolate said source and identify said fault. 
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16. The method for fault diagnosis as described in 
Claim 15, wherein el) comprises: 

determining gueue length in network devices; 
determining delay over a path in said data network; and 
5 determining load of traffic over said data network. 

17. The method of fault diagnosis as described in 
Claim 11, further comprising: 

guerying said data network for additional fault data if 
10 said core of fault data is insufficient to identify said 
fault . 

18. The method of fault diagnosis as described in 
Claim 11, further comprising: 

15 correcting said fault. 

19. A data network that is capable of fault diagnosis 
comprising: 

a plurality of subnetworks that generate a plurality of 
20 fault data, each of said plurality of subnetworks comprising 
network components that are coupled together via a 
distributing component; 

a plurality of performance managers coupled to said 
plurality of subnetworks for monitoring said plurality of 
25 subnetworks for said plurality of fault data and for 
filtering said plurality of fault data, each of said 
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plurality of network performance managers coupled to and 
associated with one of said plurality of subnetworks; and 

a single network management station coupled to each of 
said plurality of performance managers for analyzing said 
plurality of fault data that is filtered to identify faults 
and isolate sources of said faults. 

20. The data network as described in Claim 19, wherein 
said network components are computer systems. 

21. The data network as described in Claim 19, wherein 
said distributing component is a switch. 

22. The data network as described in Claim 19, wherein 
said plurality of fault data is management information base 
(MIB) information that is generated by said network 
components and said distributing component in each of said 
plurality of subnetworks. 

23. The data network as described in Claim 19, further 
comprising: 

a rule set that is implemented by said network 
management station for analyzing said plurality of fault data 
that is filtered to identify said faults and isolate said 
sources of said faults. 
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24. The data network as described in Claim 19, further 
comprising: 

a rule set that is implemented by each of said plurality 
of performance managers for filtering said plurality of fault 
5 data. 

25. The data network as described in Claim 19, wherein 
said plurality of fault data includes performance data from 
said data network. 

...... 10 

t5 26. The data network as described in Claim 19, wherein 

%i each of said plurality of performance managers is a self 
U diagnosing network performance manager (SDNNPM) 

|=& 15 27. A computer system comprising: 

i.~ a processor; 

p a display coupled to said processor; 

a computer readable memory coupled to said processor and 
containing program instructions that, when executed, 
20 implement a method for fault diagnosis of a data network 
comprising: 

a) receiving a plurality of fault data pertaining to 
said data network; 

b) filtering said plurality of fault data to obtain a 
25 core of fault data; and 

c) analyzing said core of fault data to identify a 
fault associated with said core of fault data. 
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28. The computer system as described in Claim 27, 
wherein b) in said method comprises: 

implementing a set of rules for filtering said plurality 
of fault data. 

29. The computer system as described in Claim 27, 
wherein b) in said method comprises: 

eliminating redundant fault data in said plurality of 
fault data to obtain said core of fault data. 

30. The computer system as described in Claim 27, 
wherein b) in said method comprises: 

bl) correlating said plurality of fault data into 
recognized patterns of data comprising said core of fault 
data. 

31. The computer system as described in Claim 27, 
wherein said plurality of fault data is taken from a group 
consisting of : 

alarms; 
events ; 

remote monitoring (RMON)-l data; and 
RMON-2 data. 

32. The computer system as described in Claim 27, 
wherein c) in said method further comprises: 
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determining whether said fault is due to a broken link 
or congestion in said data network. 

33. The computer system as described in Claim 32, 
wherein said method further comprises: 

implementing a ping walk through said data network to 
determine a location of said broken link, if said fault is 
due to said broken link. 

34. The computer system as described in Claim 32, 
wherein said method further comprises: 

isolating a source of said fault, if said fault is due 
to said congestion in said data network. 

35. The computer system as described in Claim 27, 
wherein said method further comprises: 

displaying network location of said fault; and 
displaying a cause of said fault. 

36. The computer system as described in Claim 27, 
wherein said fault data includes performance data from said 
data network. 
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